BSD PortsFreeIPA -- multiple vulnerabilities
· CVE-2026-53683, CVE-2026-86593 · VuXML entry
The FreeIPA project reports: CVE-2026-53683: client-side open redirect in reset_password.html. The page takes the url query parameter as a redirection target without validating or allow-listing it, so an attacker can send a user to an arbitrary site once the password reset completes. No authentication is required, and the link appears to come from the IdM domain, which makes it useful for phishing. CVE-2026-86593: …
Affected versions
- freeipa-server < 4.13.5
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | net/freeipa-server | 4.13.5 | fixed |